# v0.26.0 HTTP error and security-header validation Date: 2026-08-14 Release: 0.26.0 Scope: English MachineIntelligences.org root-deployable package This validation covers the first-party 404 recovery response, Apache `ErrorDocument` behavior, conservative browser-response security-header readiness, and regression preservation of the v0.25.0 release-integrity contract plus the existing research/reference, accessibility, media, delivery, UAIX, and clean-URL surfaces. ## HTTP error handling - `/404/` is a utility error target rather than a canonical public content route. - Direct application rendering returns HTTP 404, one H1, one main landmark, one footer, and `noindex,follow`. - The 404 response emits no canonical link, no Open Graph page URL, and no JSON-LD page identity. - It links to known first-party recovery destinations: Home, Research Navigator, Glossary, Respect, Transparency, and Sitemap. - It contains no public `.php` destination and is absent from `sitemap.xml`. - Root `.htaccess` declares `ErrorDocument 404 /404/` and disables MultiViews. - A local Apache 2.4 compatibility run confirmed that a representative nonexistent URL was served through the first-party ErrorDocument while retaining HTTP 404. The PHP built-in development server does not implement Apache `.htaccess` behavior and may resolve unknown directory-style paths differently. It is used for canonical-route/application regression tests, not as proof of Apache ErrorDocument behavior. ## Security-header readiness Inside the existing `mod_headers` optional-module guard, the package declares: - `X-Content-Type-Options: nosniff` - `Referrer-Policy: strict-origin-when-cross-origin` - `X-Frame-Options: SAMEORIGIN` The local host's default Apache module set did not enable `mod_headers`. A separate compatibility run explicitly loaded the locally installed module and confirmed all three configured headers on a representative HTML response. This demonstrates configuration compatibility in the local test environment only. It does not establish production Apache version, module availability, virtual-host policy, reverse-proxy behavior, TLS behavior, or live response headers. No Content Security Policy, HSTS policy, cross-origin isolation policy, remote security service, or third-party runtime dependency was introduced in this release. ## Canonical route and metadata regression - **132 PHP files** pass `php -l` after adding the error target. - Native JavaScript passes syntax validation. - **110/110 canonical sitemap routes** return HTTP 200 from the local PHP application server. - All 110 canonical routes retain one H1/main/footer, unique titles and descriptions, clean self canonicals, matching Open Graph page URLs, and parseable JSON-LD. - Every canonical route references exactly `/assets/css/site.css?v=0.26.0` and `/assets/js/site.js?v=0.26.0`; asset query state does not enter page canonical identity. - **232 clean-URL redirect assertions** remain valid across missing-slash, explicit route `/index.php`, homepage `/index.php`, and legacy root PHP endpoints. - Sitemap remains **110 canonical URLs, 8 image entries, and 1 video entry**; `/404/` is not promoted into sitemap content. - Rendered first-party URL attributes contain no public local `.php` destinations. - **1,345 unique rendered local target/fragment combinations** resolve after the current validation record is present. ## Research and evidence preservation - `report-manifest.json`, `includes/glossary-data.php`, and the 42-entry source-bundle disposition ledger remain byte-identical to v0.25.0. - **49/49 curated report bodies** remain byte-identical to v0.25.0. - **49/49 curated SHA-256 values** match current report bytes. - **49/49 original source SHA-256 identities** are re-grounded against the supplied individual source attachments and/or the supplied research ZIP. - Every curated report retains `#curation-boundary` and `#research-body` anchors. - `includes/research-library.php`, `includes/research-references.php`, `assets/css/site.css`, and `assets/js/site.js` remain byte-identical to v0.25.0. - The local reference system remains **3,932 occurrences, 1,900 unique normalized URLs, and 1,070 normalized domains across 49 reports**. ## Release-integrity regression The v0.25.0 manifest model remains unchanged: finalize every regular web-root file, generate static `release-manifest.json`, exclude only the manifest itself to avoid recursive self-hashing, then compare the final clean-extracted file set, byte sizes, and SHA-256 values against the manifest. For v0.26.0 the final manifest is required to cover **326 regular web-root files**, with `release-manifest.json` as the single documented exclusion. Full manifest file-set, size, and SHA-256 equality is re-run against the clean extracted handoff package before release. ## UAIX and hygiene regression - The exact UAIX wizard/update URL remains present once in each required owning file. - All durable UAIX path and declared section/review-section targets are revalidated after v0.26.0 history/validation pointers are added. - TABOO-001 leakage outside its owning rule record: **0**. - Focused raw-secret marker findings: **0**. - `agent-file-handoff/Content/` and `agent-file-handoff/Improvement/` contain inert `.keep` placeholders only. - Git metadata/history remains unavailable in the supplied package context. - No live deployment was performed or authorized. ## Evidence boundary The local Apache test demonstrates that this package's ErrorDocument and header configuration are compatible with the tested Apache/PHP environment. It does not prove production server configuration. The static release manifest proves packaged byte identity only within its stated file scope. Neither form of evidence proves authorship, autonomous execution, external factual correctness, source authority, legal identity/ownership, production indexing, or independent cryptographic editorial provenance.