Historical AIE hosting release-readiness record#

Audience: maintainers investigating the 2026-08-01 AIE migration. This is a dated evidence record, not a current deployment plan or proof of live readiness. Use the Forge Deploy overview for current product behavior, the operator runbook for a new release, and the delivery reconciliation contract for the active control-plane boundary.

Historical snapshot captured on 2026-08-01: three immutable previews had been produced; production traffic cutover had not started.

This report keeps source, database migration, runner activation, preview publication, production promotion, provider-domain reconciliation, DNS, and Vercel retirement separate. A green build or preview is not production proof.

A later live read-only audit on 2026-08-01 found zero current deployments, preview endpoints, provider artifacts, activations, or connected bindings for the AIE projects. The preview URLs, provider versions, and runner identity below are historical evidence only; they are not current readiness proof.

Historical immutable state#

Forge source is pushed at 09da814afd3e9b3f8025e52213e6d172ee9beb3a. Production D1 includes migration 0060_opennext_prebuild_reuse.sql, applied after capturing a Time Travel recovery bookmark and verifying the complete migration ledger, schema inventory, and foreign-key invariants.

The active production runner is:

• source commit: 09da814afd3e9b3f8025e52213e6d172ee9beb3a;
• Worker Version: a755da89-a8b2-4812-bd57-028aa6e58fc4 at 100%;
• image: cloudflare-sandbox-0.12.3-standard-4-node-pnpm-bun-wrangler-v3;
• toolchain digest: 1804240da84ec9976ae33333f256ae9cf731a9d656dad8f83d2ba31098b50547.

The Forge API was not released in this operation. API-side source fixes and the rendered official documentation therefore remain pushed source until a separate guarded API release verifies its own Worker Version and live routes.

Forge platform behavior delivered#

• deploy_projects is authoritative for independent monorepo roots, releases, previews, production pointers, provider targets, and rollbacks.
• Private exact-SHA materialization keeps Git and provider credentials out of the sandbox and rejects cross-repository or unauthorized reads.
• Connected asset ingest is entitlement driven, retains the 25 MiB per-file and provider file-count ceilings, and supports a 1 GiB AIE release.
• The Forge-owned opennext-cloudflare preset requires a lockfile-pinned project-local OpenNext dependency, derives the Worker and asset output, and publishes through the existing credential-free Wrangler compiler.
• Connected Cloudflare custom domains and path routes are administrator-only, project scoped, explicitly applied, auditable, retryable, and reversibly detached.
• Forge Assets uses standard Git LFS pointer and Batch-transfer semantics. A local git-lfs binary is optional; Forge and the migration assistant can create, upload, and hydrate pointers without it.
• Exact-input OpenNext prebuild reuse is fail closed. Its key includes source, project/config, lockfile/OpenNext/adapter, build environment, provider target/bindings/policy, and entitlements. It re-verifies the retained immutable provider Worker Version before attaching it to a distinct release.

OpenNext rebuilds are not required to be byte-identical. Next creates fresh draft/preview encryption material, and concurrent prerendering can serialize the same routes in a different order. Reuse therefore depends on a complete exact-input identity plus retained-provider verification, not a raw output hash match.

Source verification#

The clean Forge integration checkout passed:

• API: 148 files and 769 tests;
• runner: 59 files and 505 tests;
• Sites Worker: 10 files and 59 tests;
• deploy runtime: 7 files and 25 tests;
• AI router: 4 files and 14 tests;
• Wiki Worker: 11 files and 37 tests;
• repository-wide TypeScript checks, migration/adoption tests, YAML and shell syntax checks, and design-asset verification.

Two stale source defects exposed by the full run were corrected before the release: a calendar-expired account-cap fixture and provider rollback fencing that used a historical candidate base instead of the current active version.

Historical AIE preview state#

The private Forge repository is swyx/aiecode2025. Its reviewed source is:

• commit: 567f8bd2393375cf61e7d302460df308c5c65913;
• project roots: apps/main, apps/2025-sites, and apps/2023-2024-sites;
• publication mode: manual for all three projects.

At the time of this snapshot, each project had an independent preview and no active production deployment:

Project	Immutable preview	Provider Worker Version
main	https://preview-deploy-d7c1efd9fd2c43ac96d48c808021f877.sites.smol.ai	8d461856-b0f9-483f-bed4-5e1a7e6709e4
2025	https://preview-deploy-cae24c078c8b412592dc082e11c2efdf.sites.smol.ai	026b5683-10b0-457b-a4e4-e621a0481a63
2023-2024	https://preview-deploy-fe509aabf2584a35afc4ab6f90d497e9.sites.smol.ai	97ef4296-2220-410b-b8bc-e12072137fde

The 2023-2024 preview is a distinct release produced by the exact-input reuse path. It reused the verified artifact and provider Worker Version without dependency installation or an OpenNext build. Runner occupancy fell from about 564 seconds for its full build to 41.9 seconds for reuse. Exact private source checkout consumed 35.6 seconds and is now the dominant optional speed improvement; projection-archive caching is not required for cutover.

Route and rendered-page proof#

The repository's existing route smoke suite passed against the three preview origins and confirmed all three /api/deploy-info responses report source commit 567f8bd2393375cf61e7d302460df308c5c65913.

An additional registry-derived HTTP matrix passed 60 of 60 checks. It covered:

• the main index and stable policy/about/newsletter routes;
• every registered current conference and every registered schedule route;
• all six frozen 2023-2025 conference roots and their schedules, both directly and through the main preview;
• compatibility redirects, external CFP routing, metadata endpoints, and representative AI-readable JSON/Markdown routes.

Rendered browser checks covered the 2026 World's Fair main page, the 2024 World's Fair archive at a mobile viewport, and the 2025 Code archive. The checked pages had no console errors, horizontal overflow, or broken sampled images. The 2025 Code hero begins with its intentional typewriter animation.

Preview-only frozen-zone nuance#

The current main preview's frozen-zone rewrites target earlier immutable Forge zone previews built from source 34584fbdb2f7a3215375675e82060d84af7dc535. Comparing all 11 frozen roots and schedule pages with the final zone previews found equal response lengths and identical content except for the embedded Next build ID and its two build-manifest URLs. This is functional parity, but it is not exact-SHA forwarding.

Do not copy those preview rewrites into the production cutover. The preferred cutover shape is explicit Cloudflare path routes for the frozen conference paths and their static prefixes, with the main Worker remaining the catch-all. If the operator instead chooses main-Worker proxying, rebuild main with the selected immutable zone origins and verify those origins before promotion.

Forge now models each archive path as one desired-state binding. AIE explicitly chooses reserved_prefix, which emits a terminal-wildcard provider route and therefore owns the query-bearing root and descendants. The reviewed choice also accepts lexical-sibling capture for those frozen namespaces. AIE's document-navigation fallback still avoids Pages Router /_next/data/<build-id>/... client-navigation requests outside each prefix. The remaining gate is operational rather than architectural: release the Forge source, apply its migrations with recovery evidence, provision the approved targets, import and apply the reviewed configuration, then prove the routes and rollback live before production cutover.

Production boundary and remaining gates#

Production D1 currently proves:

• all three project production environments have active_deployment_id = NULL;
• all three projects have zero connected custom-domain or path-route bindings;
• the later live audit found zero current deployments, preview endpoints, provider artifacts, or activations;
• production promotion policy remains manual.

No AIE custom domain, DNS record, production traffic pointer, or Vercel deployment changed. Vercel remains the production host.

Before cutover:

1. Revoke and rotate the GitHub Packages credential that had been committed in apps/2023-2024-sites/.npmrc. The file is removed and future .npmrc files are ignored, but the old credential remains in Git history.
2. Produce fresh immutable previews and have an AIE administrator review them.
3. Choose and explicitly apply the frozen-zone path-route or proxy topology, including /2023-2024-static/* and /2025-static/* ownership.
4. Promote the freshly verified immutable releases without rebuilding, attach the reviewed hostname/routes, and verify certificates, deployment identity, headers, redirects, main routes, archive routes, and rollback live.
5. Retire Vercel only after a separate observation window and rollback review.

Production cutover requires a new explicit decision; it is not authorized by this report.