doing · High priority

VRC.LOL Go Web Platform Migration

99% through the measured Go/Caddy migration gates. The Go homepage starts from embedded, reviewed English and ten localized document shells and renders all twenty-one bounded regions, the complete typed JSON-LD graph, localized metadata, shared assets and runtime scripts. A separately versioned atomic event repository remains authoritative for the changing timeline and Event schema, with last-known-good serving and cross-surface validation. The recurring verifier compares every locale with current PHP while normalising only the three deliberate page-modified timestamps; desktop and 390 by 844 mobile audits retain layout, asset and accessibility parity. A stable 5% public human cohort is running through the public Caddy edge with PHP as an in-request fallback on the private OpenLiteSpeed origin. Outcome telemetry contains only result, bounded fallback reason and private fetch latency. A separate privacy-safe eligibility funnel stores aggregate selector categories and coarse 5% cohort bands without IPs, user agents, URLs, languages, exact buckets or reusable identifiers, distinguishing repeated traffic from broad cohort coverage. Synthetic verifier requests are excluded from the traffic-only promotion window, which requires 20 clean views, 24 clean hours and a newest real outcome no more than 30 minutes old. Caddy owns public ports 80/443 and OpenLiteSpeed is retained only on the protected loopback TLS origin at 127.0.0.1:8088. A one-minute watchdog checks both layers and independently monitored host outcomes. Guarded post-cutover promotions permit only 5, 10, 25, 50 and 100 percent, require a separate clean gate for every increase and archive the preceding cohort so evidence cannot be reused. Completion of those measured homepage cohorts is the remaining web gate. The independent edge serves status.vrc.lol, live.vrc.lol and dl.vrc.lol through Caddy with automatic HTTPS and native Gatus monitoring. The pre-cutover loopback rehearsal remains archived evidence for every confirmed hostname, both canonical redirects and unknown-host rejection; Caddy has since taken public ownership while OpenLiteSpeed remains private on loopback. The guarded cutover manager now preserves the origin-only OLS configuration, reports the active topology, and permits only the next homepage cohort after its independent observation gate opens and a separate literal confirmation is supplied. Independent Gatus checks now cover the panel and MRC website, both canonical www redirects and a seven-day certificate threshold across every monitored HTTPS surface, providing external post-cutover evidence in addition to local transactional checks. The completed public activation required independent checks newer than its cutover start; missing or failed external observations still enter the automatic rollback path within two minutes. The independent edge also rejects common environment, Git and PHP-configuration scanner paths before they reach Gatus or a static document root. Its branded status dashboard uses edge-local assets, while the invited Companion release is stored outside every public document root and served by a loopback-only native Go service. Browser downloads retain the existing invitation gate through short-lived, user-agent-bound, single-use URLs; updater requests retain their private channel check. Every release sync is size- and SHA-256-gated, installed atomically and followed by full edge verification. The active public hosts pass response-header continuity checks without exposing Server or Via, and their canonical access logs are bounded, sampled and privacy-filtered: query values are redacted while client addresses, forwarding data, user agents, referrers, cookies and credentials are removed before writing. An ephemeral runtime test sends fake query and identifying-header secrets and proves they never reach disk; preflight separately adapts the active Caddyfile and rejects drift in its three canonical logger policies. The active post-cutover watchdog checks local listeners, the private origin and fresh independent monitoring every minute, resets on recovery and invokes the existing rollback transaction only after three consecutive failures. Its systemd timer is required to have a concrete next trigger after activation, and both preflight and the recurring verifier reject an enabled-but-elapsed timer. A distributed expensive-route overload is bounded by process-global concurrency slots for dynamic League matchup renders and large profile-sitemap shards; saturated requests receive a short Retry-After response instead of exhausting the origin, and the validated Caddy proxy topology remains active. OpenLiteSpeed accepts forwarded client addresses only from the active loopback Caddy proxy, and an external regression test proves a direct client cannot change its stable homepage cohort by forging X-Forwarded-For. The same boundary now covers the player renderer and Events audit trail: player cohort selection uses the validated peer, Events does not copy raw forwarding identity, and forwarded scheme compatibility is accepted only from an actual loopback proxy. External probes confirm forged forwarding input cannot change either homepage or player cohorts. The recurring private canary verifier also enforces the reviewed security headers and rejects exposed Server or Via values between full preflight runs. An inert post-100% rehearsal now proves Caddy can send only eligible human homepage reads directly to Go while bots, explicit PHP controls, unsupported query shapes, writes and every non-root route remain on the private OLS origin; it is loopback-only, cleans up after itself and cannot activate or shorten a cohort gate. The final direct-home candidate is now wired into a separate fail-closed manager transaction that remains unavailable until the 100% cohort earns its own fresh gate; it requires an explicit bypass confirmation, saves the active Caddyfile, verifies both direct Go and excluded-agent OLS routes, and gives the watchdog a narrower direct-route rollback before any full edge rollback.