> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withheadlight.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verification runbook

# Verification runbook

Use this after deploy or when onboarding a new partner origin.

## DNS

1. Confirm Cloudflare record is **DNS only** (grey cloud).
2. Fetch embed HTML and verify response headers do **not** include `cf-ray` or `server: cloudflare`.

## CSP

1. Load `https://embed.withheadlight.com/chart/v<version>/index.html`.
2. Assert `Content-Security-Policy` matches the published policy for chart surfaces.
3. Confirm `frame-ancestors` lists only approved partner origins.

## Artifact integrity

1. Fetch `https://embed.withheadlight.com/versions.json`.
2. Compare `assetDigests` to files served under the pinned version prefix.

## Mint route

1. Mint with allowed `frameOrigin` → 200.
2. Mint with disallowed origin → 400.
3. Mint without `embed:chart` permission → 403.

## Framing

1. Load partner page that embeds the chart.
2. Confirm iframe receives `ready`, posts `render`, and receives `rendered`.
3. Click a node and confirm `nodeClick` returns partner-scoped IDs.

## Bundle absence

Run `bun run embed:build` then the embed bundle cleanliness test. The artifact must not contain Sentry, PostHog, Prisma client code, `report-uri`, Google Fonts links, or `dangerouslySetInnerHTML`.