An AI agent that shows its working

pipelines/01-site.yml:40–67

    gates:
      - name: ContentIntegrity
        steps:
          - template: /pipelines/steps/node.yml@QuidneDeploy
          - template: /pipelines/steps/pester.yml@QuidneDeploy
            parameters:
              testPath: tests/Site.Integrity.Tests.ps1
      - name: ConfigSchema
        steps:
          - template: /pipelines/steps/pester.yml@QuidneDeploy
            parameters:
              testPath: tests/Site.Config.Tests.ps1
      - name: ModuleSyntax
        steps:
          - template: /pipelines/steps/module-syntax.yml@QuidneDeploy
            parameters:
              scriptRoot: src/js
      - name: DeploySpecs
        steps:
          - template: /pipelines/steps/pester.yml@QuidneDeploy
            parameters:
              testPath:
                - tests/Deploy.*.Tests.ps1
                - tests/Verify.*.Tests.ps1
                - tests/Local.*.Tests.ps1
                - tests/Tools.*.Tests.ps1
                - tests/Site.Content.Tests.ps1
                - deploy/modules

pipelines/01-site.yml:91–102

      - target: UAT
        serviceConnection: uat-quidne-site
        environment: uat-quidne-site
        dependsOn: DeployDEV
        mainOnly: true
        preview: true
      - target: PROD
        serviceConnection: prod-quidne-site
        environment: prod-quidne-site
        dependsOn: DeployUAT
        mainOnly: true
        preview: true

README.md:13

| `pipelines/` | `01-site.yml`, extending Quidne.Deploy's `swa-pipeline.yml`: build the site and API once, deploy DEV, promote to UAT and PROD by approval |

pipelines/templates/steps-api-deploy.yml:22–37

        # The package the build tested, not a rebuild of this agent's checkout.
        $result = Invoke-DeployApi `
            -RepoRoot $repoRoot `
            -Environment '$(deployTarget)' `
            -PackagePath '$(Pipeline.Workspace)/api-package/Quidne.Contact.zip' `
            -Version '$(Build.SourceVersion)'

        $result | Select-Object Environment, FunctionApp, DefaultHostname, Version | Format-List | Out-String | Write-Host

        $code = Invoke-VerifyApi `
            -RepoRoot $repoRoot `
            -Environment '$(deployTarget)' `
            -Hostname (Get-DeploymentDefaults -RepoRoot $repoRoot -Environment '$(deployTarget)').ApiHostname `
            -ExpectedVersion '$(Build.SourceVersion)'

        if ($code -ne 0) { throw "Invoke-VerifyApi reported $code failing checks for $(deployTarget)." }

deploy/modules/verify-api.ps1:216–231

    $results = [System.Collections.Generic.List[object]]::new()
    $results.AddRange([object[]]@(Test-ApiAvailability -Hostname $Hostname -Environment $Environment -ExpectedVersion $ExpectedVersion))
    $results.AddRange([object[]]@(Test-ApiCors -Hostname $Hostname -Origin $Origin))
    $results.AddRange([object[]]@(Test-ApiRejection -Hostname $Hostname))
    $results.AddRange([object[]]@(Test-SiteTls -Hostname $Hostname))

    foreach ($result in $results) {
        $mark = if ($result.Passed) { 'PASS' } else { 'FAIL' }
        Write-Host "  $mark [$($result.Check)] $($result.Name) — $($result.Detail)"
    }

    $failed = @($results | Where-Object { -not $_.Passed })
    if ($failed.Count -gt 0) {
        Write-Host "$($failed.Count) of $($results.Count) checks failed."
        return 1
    }

deploy/modules/verify-site.ps1:837–843

    $results = [System.Collections.Generic.List[object]]::new()
    $results.AddRange([object[]]@(Test-SiteAvailability -Hostname $Hostname -RequireResumePage:$RequireResumePage))
    $results.AddRange([object[]]@(Test-SiteTls -Hostname $Hostname))
    $results.AddRange([object[]]@(Test-SiteContentIdentity -Hostname $Hostname -Manifest $manifest))
    $results.AddRange([object[]]@(Test-SiteSecurityHeader -Hostname $Hostname -ConfigPath $configPath))
    $results.AddRange([object[]]@(Test-SiteCacheHeader -Hostname $Hostname -ConfigPath $configPath -Manifest $manifest))
    $results.AddRange([object[]]@(Test-SiteAppConfig -Hostname $Hostname -Environment $Environment -ExpectedSetting $expectedSetting -ExpectedCheckCount $plan.Total))

deploy/modules/verify-site.ps1:882–896

    # Recomputing the manifest here would compare the agent's tree against itself, green even on a failed upload.
    if ([string]::IsNullOrWhiteSpace($ManifestPath) -or -not (Test-Path -LiteralPath $ManifestPath -PathType Leaf)) {
        throw "Invoke-Verify needs the build's site manifest; none at '$ManifestPath'."
    }

    if (-not (Get-Command -Name 'Get-DeploymentDefaults' -ErrorAction SilentlyContinue)) {
        throw "Get-DeploymentDefaults is not available. Dot-source deploy/Import-Site.ps1 first."
    }

    $hostnameArgs = @{}
    $verifyHostname = (Get-DeploymentDefaults -RepoRoot $RepoRoot -Environment $Environment).VerifyHostname
    if (-not [string]::IsNullOrWhiteSpace($verifyHostname)) { $hostnameArgs['Hostname'] = $verifyHostname }

    Invoke-VerifySite -RepoRoot $RepoRoot -Environment $Environment -ManifestPath $ManifestPath `
        -RequireResumePage @hostnameArgs

deploy/modules/verify-site.ps1:850–863

    $failed = @($results | Where-Object { -not $_.Passed })
    if ($failed.Count -gt 0) {
        Write-Host "$($failed.Count) of $($results.Count) checks failed."
        return 1
    }

    # The site publishes the planned count, so a plan that drifted from the run is a false claim on the page.
    if ($results.Count -ne $plan.Total) {
        Write-Host "All $($results.Count) checks passed, but the stamped plan says $($plan.Total)."
        return 1
    }

    Write-Host "All $($results.Count) checks passed."
    0

workstreams/quidne-public-website-refactor.md:350–352

Needs Phase 0. Each phase is independently revertible; every DNS-mutating run publishes a full
`record-set list` snapshot as an artifact first, and `docs/DNS-CUTOVER.md` carries the literal revert
commands. TTL 300 everywhere means worst-case restore is ~5 minutes.

workstreams/quidne-public-website-refactor.md:354–366

1. **DEV** — full pipeline, `dev.quidne.com`. Zero production risk; settles the remaining spikes.
2. **UAT** — same at `uat.quidne.com`. The sign-off surface, including `/resumes/jasonking/`.
3. **PROD provisioned, no DNS** — verify everything against the `*.azurestaticapps.net` hostname. The old
   App Service still serves 100% of traffic, untouched.
4. **`www` first** — T-24 h drop TTLs; snapshot; repoint `www` CNAME to the SWA and bind the domain. `www`
   serves the new site while the apex still serves the old. **Soak 48 h.** Blast radius is `www` only;
   revert is one `set-record`.
5. **Apex** — per the Phase 5 sequence, in a low-traffic window. On rollback, restore
   `A @ 104.42.231.5` but **leave the SWA validation TXT value in place** so re-cutover needs no
   re-validation.
6. **Decommission at T+30 days** — stop (don't delete) App Service `quidnepublic`, wait 7 more days, then
   remove its TXT marker, audit the three `ms-domain-verification` values before touching any, delete the
   App Service and plan, and retire the `.bat`/pkzip/`\\thorin` scripts.

workstreams/quidne-public-website-refactor.tracker.md:603–607

| P7.1 | Cutover step 1 — DEV at `dev.quidne.com` | 23 | 2026-09-22 · `Ready` on attempt 6; 200 + sentinel on DigiCert `CN=dev.quidne.com` to 2027-03-22; `Invoke-VerifySite -Environment DEV -Hostname dev.quidne.com -RequireResumePage` returns **0 on all 39** |
| D4 | Pin line endings so one commit deploys one content hash | 23 | 2026-09-22 · `.gitattributes` (`* text=auto eol=lf`) · found via check 3 failing 25 of 102 files; local `src/` hash back to `043c1f36…`, matching the deployed tree · see the chunk 23 standing fact |
| P7.2 | Cutover step 2 — UAT at `uat.quidne.com` | 25 | 2026-09-23 · run 831 (`20260923.1`) · approval 29 approved 13:32:53Z, `Verifying UAT at https://uat.quidne.com/` → all 39 checks passed |
| P7.3 | Cutover step 3 — PROD provisioned, no DNS | 26 | 2026-09-23 · run 832 (`20260923.2`) · blocked 14:12:21Z→14:26:38Z on approval 30, verified all 39 against `lemon-sand-082e0321e.1.azurestaticapps.net`; zone hash `9dc070f4…` identical either side |
| P7.4 | Cutover step 4 — `www` first, 48 h soak | 27 | 2026-09-25 · `C:\AI.IO\QuidnePublicWebsite\soak\www-soak.csv` · 76 rows 2026-09-23T15:08Z→2026-09-25T14:40Z, 75 OK, 1 RED (observer offline — see the chunk 27 standing fact); one body hash throughout; re-asserted at close: `www` 200 + sentinel, `http://quidne.com/` 200 from `104.42.231.5` |

workstreams/quidne-public-website-refactor.tracker.md:607

| P7.4 | Cutover step 4 — `www` first, 48 h soak | 27 | 2026-09-25 · `C:\AI.IO\QuidnePublicWebsite\soak\www-soak.csv` · 76 rows 2026-09-23T15:08Z→2026-09-25T14:40Z, 75 OK, 1 RED (observer offline — see the chunk 27 standing fact); one body hash throughout; re-asserted at close: `www` 200 + sentinel, `http://quidne.com/` 200 from `104.42.231.5` |

workstreams/quidne-public-website-refactor.tracker.md:410–422

**Status:** Done · Chunk 28 — apex serving the new site since 2026-09-25 ~20:40Z

Per the Phase 5 sequence, **in a low-traffic window**. On rollback, restore `A @ 104.42.231.5` but **leave
the SWA validation TXT value in place** so re-cutover needs no re-validation.

**Acceptance criteria**
- [x] Cut over in the chunk 28 session itself — window decided 2026-09-25: now, ~20:15Z
- [x] Snapshot exported before the change — `C:\AI.IO\QuidnePublicWebsite\dns-snapshot\quidne.com-20260925-202513.json`, 18 record sets
- [x] Apex bound per P5.3 and reaching `Ready` — registered 20:27:18Z, `Ready` on attempt 10
- [x] `https://quidne.com/` serves the new site; `Invoke-VerifySite -Environment PROD -Hostname quidne.com
      -RequireResumePage` returns **0 on all 39** against the deployed tree (D5 stashed for the run)
- [x] Mail unaffected — MX and TXT re-read from `ns1-03`: identical but for the appended token
      (`C:\AI.IO\QuidnePublicWebsite\dns-snapshot\mail-{before,after}-apex-20260925.txt`)

workstreams/quidne-public-website-refactor.tracker.md:479

| **The alias write makes the apex 404 until `Ready`** | The parent's order puts the alias before the wait, so `http://quidne.com/` answered SWA's 404 for ~13 min (registered 20:27:18Z, `Ready` on attempt 10 of 40). `Validating` with `errorMessage: null` throughout — slow, not failing. A re-cutover should expect the same gap, or try the alias after `Ready` and record whether validation still completes |

workstreams/quidne-public-website-refactor.tracker.md:457–463

### P7.6. Cutover step 6 — decommission at T+30

**Status:** Not started · Chunk 29

**Stop, do not delete.** Stop App Service `quidnepublic`, wait 7 more days, then remove its TXT marker,
**audit the three `ms-domain-verification` values before touching any**, delete the App Service and plan,
and retire the `.bat`/pkzip/`\\thorin` scripts.

workstreams/quidne-public-website-refactor.md:161

5. Repoint the registrar's nameservers to `az network dns zone show --query nameServers`.

deploy/modules/verify-site.ps1:254–256

        # A stalled managed renewal shows up here long before it shows up as an outage.
        $results.Add((New-SiteCheckResult -Check 'TLS' -Name "more than $MinimumDaysRemaining days remaining" `
                    -Passed ($daysRemaining -gt $MinimumDaysRemaining) -Detail "$daysRemaining days"))

workstreams/quidne-public-website-refactor.tracker.md:410

**Status:** Done · Chunk 28 — apex serving the new site since 2026-09-25 ~20:40Z

workstreams/quidne-public-website-refactor.tracker.md:457–466

### P7.6. Cutover step 6 — decommission at T+30

**Status:** Not started · Chunk 29

**Stop, do not delete.** Stop App Service `quidnepublic`, wait 7 more days, then remove its TXT marker,
**audit the three `ms-domain-verification` values before touching any**, delete the App Service and plan,
and retire the `.bat`/pkzip/`\\thorin` scripts.

**Acceptance criteria**
- [ ] `quidnepublic` stopped at T+30 with the date recorded; site still serving from the SWA

workstreams/quidne-public-website-refactor.tracker.md:33–35

**No chunk is calendar-gated any more.** Chunk 8 was the last one — it wanted 7 days of verified mail flow
after chunk 5, and it closed 2026-09-22 on the developer's attestation rather than on that evidence. Nothing
in this tracker now waits on a clock.